DevOps Governance Rules Anchor (Sprint 33)
Scope · Exit deliverable for
DEVOPS-RULES-33-001
Audience · DevOps Guild, Platform leads, service owners
Related ·ops/devops/TASKS.md,docs/backlog/2025-10-cleanup.md,docs/modules/platform/architecture-overview.md
This note consolidates the platform governance rules ratified on 30 October 2025.
Each rule captures intent, affected surfaces, enforcement actions, and references to the source-of-truth backlogs so that subsequent sprints do not re‑introduce conflicting work.
| Rule | Intent & Rationale | Enforcement & Ownership | Follow-ups |
|---|---|---|---|
| Gateway is a proxy only; Policy Engine owns overlays/simulations. | Keep Gateway thin and deterministic: it authenticates, authorises, and forwards requests. All overlay composition, simulation, and policy evaluation stays inside Policy Engine so we avoid duplicated logic and time-of-check drift. | Owners: BE‑Base Platform Guild + Policy Engine Guild. Enforcement: Gateway PR reviews block embedded overlay code, new endpoints require Policy Engine contracts, CI parity checks compare Gateway ↔ Policy overlay schemas. | - Update open tasks referencing “gateway overlay” work to point at POLICY-ENGINE-20-00x.- Close or rewrite backlog items WEB-POLICY-20-00x that attempted to compute overlays in Gateway. |
| AOC ingestion is canonical-only; no merges at ingest. | Concelier/Excititor persist upstream truth plus provenance. Derived severity, merges, or dedupe belong to downstream Policy workflows. This keeps ingestion auditable and replayable. | Owners: Concelier & Excititor guilds, DevOps Guild for CI pipelines. Enforcement: StellaOps.Aoc guard library, Mongo validators, Roslyn analyzer backlog (WEB-AOC-19-003), CI job stella aoc verify. | - Ensure ingestion tasks reference the guard library (StellaOps.Aoc).- Retire legacy tasks that still mention merge-at-ingest (see backlog cleanup note). |
| Single graph platform: Graph Indexer + Graph API (Cartographer retired). | Replace the historical Cartographer service with the Graph Indexer + Graph API pairing so graph storage, overlays, and explorer flows share one platform. | Owners: Graph Platform Guild, Scheduler Guild, DevOps Guild. Enforcement: New graph work lands in docs/modules/graph/** and src/Graph/**. Gateway/UI/CLI tickets reference the Graph API endpoints only. | - Archive Cartographer handshake docs and mark Cartographer backlog items as historical. - Update Scheduler/SBOM/Console tickets to depend on GRAPH-* IDs instead of CARTO-*. |
Tracking & documentation
- ✅ Rules recorded in the corresponding sprint file
/docs/implplan/SPRINT_*.md(Sprint 33) and/docs/ops/devops/TASKS.md. - ✅ Repository-wide references to “Cartographer as active platform” updated (see backlog note amendment and doc banner).
- ✅ Changelog entry (
docs/updates/2025-10-30-devops-governance.md) captures reviewer acknowledgement.
Changing these rules
Future adjustments must update this file and reference DEVOPS-RULES-33-001 in the proposing change, so the DevOps Guild can track the history of each rule.